first (and ugly) version of Yesod oauth handshake